  
MAC FORENSICSmacOSfast forensics

     https://www.sans.org/security-resources/posters/dfir/windows-forensic-analysis-japanese-translation-185

)(I

(TT
• 0;"<S]ZF29.A$(>;+8 EDC
Mac Forensics; KY]PF3C8+,08F826+=3
ü WHKZOQTXNI9:<D4)I]TJWHMV@S]Z;YK\73ü #%>402-+;7)I]TJWHMV?1/&2-DAD=5Gü UJQM;  :<*=BD4)WHQVWL[\PRM B;F2=3ü High Sierra'(APFS)F !:26+=3
• Introduction• !(%
• !(%#"#&' • !(% • APPENDIX

$(• Introduction• !(%
• !(%#"#&' • !(% • APPENDIX

$(INTRODUCTION• Motive(%064-" )üMac'Forensics-$  *',*%( !CLI064( #-  *ØMac Forensics&(kanireg%( &)+ )
Ø(3.- 15/32'  (7))

INTRODUCTION• How & What (:)@67:D;O^[C64,)ü<>python3=YFWYZ9mac=TFPEWIX]S8&;09C0;2ØTriage tool(Fast forensics)9Mount tool9Parse&Filter tool=3LNR
ØGUI8+ $<!C2?=
ØU^K5/8;."8VE[MZ]H?2BØ VZ^U^Jmac_apt= O^[C #→Triage tool>'mac_apt8*BA)<QE\GRZ%C
→mac_apt>GUI-;(=8'GUI-1( C →#-;.mac_apt=parseC(0;3;( C INTRODUCTION• $-*%-#) ,&MacOSTriageFileTool
%-#

%"!+(*%-#

apfs_image_mounterPCMount'-"&

PCmac_apt + mac_ripper
'-"

mac_apt + mac_ripper
'-"

• Introduction• !(%• !(%#"#&' • !(% • APPENDIX

$(TRIAGE TOOL(MACOS FILE TRIAGE TOOL)TRIAGE TOOL(MACOS FILE TRIAGE TOOL)•  #%7F?8B6:@5B69E)#'$3>FE

ü go(4'2.app5 $4.
standalone( →python-Mac1"*3)!%,(python*#(/"0+2#%ü  $3B69EMalware: ;9AF Fraud: macripper : mac_ripper
ALLList: ',CD<=@,4&,CD<=@5 &ü ( $3B69E5( TRIAGE TOOL(MACOS FILE TRIAGE TOOL)•ü 07A / ?/$ 8*,=
evidence8-=3!
4+>.5<)07A('ü 8*,="2,;12@9#ctime('(ditto0:@607A')ü 4+>.5<"2,;12@9#btime ('(8*,="2,;12@9#spotlight"db& %mac_ripper )

TRIAGE TOOL(MACOS FILE TRIAGE TOOL)• #()/,1 4'1(,ü 11-(ü ."2.2-(*$(,ü +!3%,1 +!3%,1
ü 04&+!3%,1$USEROK
ü +!3%,1."2*
→/Library/LaunchAgents/*.plist

MOUNT TOOL(APFS IMAGE MOUNTER)

MOUNT TOOL(APFS IMAGE MOUNTER)• .APFS-9H=@5

1E017EI:-05,Mac,D8H>

ü Python3.7 
ü BrowseC<H!2E01B67F5
.A;GI?5
ü Filevault2"!!() 3
ü Mount5&split E01-.FTK(.E01'$&4/E*.,%,#)OSX FUSE+Xmount-7H;>IF"
APFS-Mac*

MOUNT TOOL(APFS IMAGE MOUNTER)

MOUNT TOOL(APFS IMAGE MOUNTER)

MOUNT TOOL(APFS IMAGE MOUNTER)• Xmount&APFS!,;26&$E01)9<-!8*;4,8;5&
8*;4%$ sudo mkdir /Volumes/apfs_image/$ sudo mkdir /Volumes/apfs_mounted/

E01&dmg %$ sudo xmount --in ewf --out dmg apfs.E01 /Volumes/apfs_image/dmg&'/10%$ hdiutil attach –nomount /Volumes/apfs_image/apfs.dmg'/103(.+&
$ diskutil ap list

FileVauly(7.:<5" )$ diskutil ap unlockVolume <Disk GUID> –nomount#/ /  !mount$ sudo mount_apfs –o rdonly,noexec,noowners /dev/disk# /Volumes/apfs_mounted/

https://www.mac4n6.com/blog/2017/11/26/mount-all-the-things-mounting-apfs-and-4k-disk-images-on-macos-1013

PARSE TOOL(MAC_RIPPER)

MAC RIPPER(GUI)• mac_apt$*,& %(Input(root)output().

!-GUI."6C@

ü Python3.7ü !-<3=C@.ü 'Browse:4B+ '@C870A28?.
ü 'Browse:4B+Output70A28?.
ü Rip:4B.!
ü !-%Finish%ü 1>C#);59/59-MAC RIPPER(')• mac_ripper@U$@'• Python3.7,; • Cli E/I• mac_ripperAmodules@QVMKB<D:%6:0IE@• RLTP*K6:0I@C($• SpotlightSO(db)2G)?!>KH 6csv
• Unified Log2G)?!>KH 6csv
• 8@.MRU. Persistence.Gatekeeper>=plistF
sqlite db>=KQVN7I@$3049290:0I(-5J360">E@E0492A&6:04+)@QVME%$(RLTP*K#6:0>4:E•1IE@E/I)• Introduction• !(%
• !(%#"#&' • !(% • APPENDIX

$(ATT&CK#%MACOS % "! • ATT&CK

InitialAccessExecution

Persistence%$

Privilege
Escalation

DefenseEvasionCredential
AccessmacOS

Discovery

LateralMovement

Collection

CommandandControl



Exfiltration

ImpactATT&CK*+&MACOS #+'$)"%(! 
•  
macOS    

InitialAccess

Execution

Persistenc
ePrivilege
Escalation

DefenseEvasionCredential Access

Discovery

LateralMovementCollection

Command andControl

Exfiltration

ImpactATT&CK/4*MACOS #4,$."(-!
•  app02&'#!14)%3*-42
.'%+! 

ü GMERAAppleJeusMac02&'#!

InitialAccessExecution

Persistence

https://blog.trendmicro.com/trendlabs-security-intelligence/mac-malware-that-spoofstrading-app-steals-user-information-uploads-it-to-website/

https://securelist.com/operation-applejeus/87553/

INITIAL ACCESS & EXECUTION & PERSISTENCE•
app0'(2& ! (mac_ripper0*5+,$!")üInitial access→Spotlight!db#kMDItemWhereFroms1-&0'(2&→Gatekeeper!db#.)435/%app&üExecution→Spotlight!db#kMDItemLastUsed1-&0'(2&→!app&MRU(Most Recent File)#üPersistence→Plist# 

%$0'(2&$INITIAL ACCESS• Initial Access→Webapp   →Spearphishing Attachment/LinkSupply Chain Compromise

InitialAccess

Execution

PersistenceINITIAL ACCESS(SPOTLIGHT20)• Spotlight%db)kMDItemWhereFroms20,üSpotloght20"&6!1-.4,→macOS$&spotlight$ +#%20 *→kMDItemWhereFroms&)'+1-.4$+*→/.Spotlight-V100/Store-V2/<UUID>/store.db(10.13)&35/$(DB +*~/Library/Metadata/CoreSpotlight/index.spotlightV3/store.db)

INITIAL ACCESS(SPOTLIGHT)• Live  mdls spotlight
(disk(apfs container)  macmount )

INITIAL ACCESS(SPOTLIGHT )• Livemdfind"spotlight !→mdfind –onlyin / -name “kMDItemWhereForems == */kMDItemWhereForems ! ##INITIAL ACCESS(SPOTLIGHT# )• Airdrop#'$

"$#  ü #'$

ü AirDrop&&&!%#  

INITIAL ACCESS(SPOTLIGHT )• Airdrop #!
ü O365 !    !kMDItemWhereFroms #!"

INITIAL ACCESS(SPOTLIGHT )• mac_ripper  mdls #"store.db# #"
ü parse spotlight binary store.db! # 

INITIAL ACCESS(SPOTLIGHT)• mac_ripper  mdls   (single modules)

store.db  ü -b 

INITIAL ACCESS(SPOTLIGHT/+)• Spotlightdb"kMDItemWhereFroms/+$ .&(0$ ükMDItemWhereFroms$ .&(0 $mac_ripper→mac_ripper(spotlight(downloaded) module)output(csv) Download#.&(0Download#/40'-1*,)324-URL!
%/40 .&(0$INITIAL ACCESS(GATEKEEPER)• Gatekeeperdb #"$!appüInternetapp   

INITIAL ACCESS(GATEKEEPER)• DBSQLite db 3.x  $üpath:/Users/[user]/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2

üMac_ripper(quarantine module)outputüsafarizip#"$    

#"$download   !#"$ !

INITIAL ACCESS(6CG:)•  (appB56D4 #* (mac_ripper&B8G9; %2*.)üInitial access→Spotlight*db(kMDItemWhereFroms) Gatekeeper*db0
6F<GA>?0*=7FEG@/CGD) 3%#B56D* 1.&2
=7FEG@  /CGD0$-3#app('3,-!+"0%.2

EXECUTION• Execution→ app   app →User Execution

InitialAccess

Execution

Persistence

EXECUTION(SPOTLIGHTE>)• Spotlight.db"2kMDItemLastUsedDateE>5)A68J5&ü . 5 kMDItemLastUsedDate"2→mac_ripper(spotlight(last_used) module).output(csv)/

$4'A68JM?7K:@IA68J.;FLJü kMDItemLastUsedDate+=N@
ü safari+zip5,%*#*
ü zip5%*ü 8L<@NH5(BIGNDC9L@)%*ü app5
, !1!- *5(*(/)app

50243

EXECUTION(SPOTLIGHT,()• 



ü.app+$&.

module!

,(# (spotlight(app_usage) module)ü+$&.0)%/'*- !
,(# (spotlight(spotlight_all_files) module)"

EXECUTION(SPOTLIGHT'#)• 

ü.app&!)

module'#(spotlight(app_usage) module)

ü&!)+$ *"%( '#(spotlight(spotlight_all_files) module)

EXECUTION(MRU)•#app)MRU(Most Recent File)'ü$(MRU$.sfl%.plist &!mac" (üpath:~/Library/Application Support/com.apple.sharedfilelist/*.sfl2~/Library/Containers/com.microsoft.*/Data/Library/Preferences/*.plist~/Library/Preferences/com.apple.finder.plist (URL%,.*+.-)

/
https://www.mac4n6.com/blog/2016/7/10/new-script-macmru-most-recently-used-plist-parser
https://github.com/mac4n6/macMRU-Parser)

EXECUTION(MRU)• app

 MRU(Most Recent File)

üdoc  MRU(Most Recent Used)
→mac_ripperoutput(mru module)

 App"$% &#(pkg)App !EXECUTION (6EJ=)• *appB46I3$&,(mac_ripper(B9J:>$'!1,-)üExecution→Spotlight,db(kMDItemLastUsed )MRU(Most Recent File)"/A>.$! (?;F5C,5GJ@.**))+#2&app.><HC@30-DI785  03 %1

PERSISTENCE• Persistence→      → Launch Agent/Launch Daemon

InitialAccessExecution

PersistencePERSISTENCE+LAUNCH AGENTS & DAEMONS,• Plist(!$) üWindowsrun key MacOSstartup"*&#(!%'üPlist mac_ripper→ Launch Agents→ ~/Library/LaunchAgents/*.plist→ /Library/LaunchAgents/*.plist
mac_ripper→ /System/Library/LaunchAgents/*.plist→ Launch Daemons→ /Library/LaunchDaemons/*.plist→ /System/Library/LaunchDaemons/*.plist→ Login Items→ ~/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm
-https://www.sentinelone.com/blog/how-malware-persists-on-macos/PERSISTENCEDLAUNCH AGENTS & DAEMONSE• Plist*"#-=45A,$2("1→plist.Windows-B789@*+0,%("1(xml, binary)→ .;?;?(plist*./+")
→ Plist+/open6>C:)(Xcode3'()
→/Library/LaunchAgents/*3xcode)%&→. open –a xcode /Library/LaunchAgents/*!

=45A-Full<8PERSISTENCELAUNCH AGENTS & DAEMONS• mac_ripper
ümac_ripper(persistence module)outputüüü  PERSISTENCELAUNCH AGENTS & DAEMONS• LaunchAgents(GMERA)ü    sh PERSISTENCE/LAUNCH AGENTS & DAEMONS0•  ""Plist(xcode(open –a xcode)$&
ümac_ripper"output#ü  -)*.",+ü #"%! &#'& !

!sh&PERSISTENCELAUNCH AGENTS & DAEMONS•  Plistxcode(open –a xcode)
ümac_ripperoutputü sh  
base64PERSISTENCE;LAUNCH AGENTS & DAEMONS<• *!base64"53:6
ü &TCP"$&&74260')%(' ##-+ü'.com.apple.udp.plist'&,8/19.' "IPPERSISTENCE(9?A<)•  ,app>89@7%(.
(mac_ripper*>:A;=%)4.0)üPersistence→$5)4>89@ 2- &4$5)4>89@1plist.  3 7%)
 ,>89@!6 5/'.>89@!+# 2"( . *&4   
• Initial accessü üMail

• ExecutionüCoreanalyticsüKnowlageC.dbübash_history, bash_sessionüInstallHistory.plist installlog• Windows usnjrnalüFSEVENT
https://www.crowdstrike.com/blog/i-know-what-you-did-last-month-a-new-artifact-of-execution-on-macos-10-13/
https://www.mac4n6.com/blog/2018/8/5/knowledge-is-power-using-the-knowledgecdb-database-on-macos-and-ios-todetermine-precise-user-and-application-usage• Introduction• !(%
• !(%#"#&' • !(% • APPENDIX

$(fpmUU• '1
üRNYCQ@BW:4D=KAS(o*06%T.NKAS'1U→ak_h/U\`_ng[2?SPlistCY9JZ'1→TimeMachineXSnapshotsU5$'1→Log/U5$'1
→3+7/U'1
ü@GOZTimelineUüKU ,Ti]mdlnbX6% )Ulcjnh,S'1•

8ü;![IL@UP>2020/1#2" <[- T 8
ü&PJF4SVf^edpSRP[GOEMH@  
• Introduction• !(%
• !(%#"#&' • !(% • APPENDIX

$(APPENDIX• Mac  

MAC3.5602/
• Windows#+#,*%

ü Windows+#3.5602/ + %ü  )*&)*% +7 T2124#
ü Mac7 $ UNIX"(7 !'-…

MAC • Mac4n6 

ü Sarah Edwards (@iamevltwin) → https://www.mac4n6.com/
ü Yogesh Khatri (@SwiftForensics) → https://www.swiftforensics.com/
ü Mac4n6(Macadmins) → https://github.com/pstirparo/mac4n6
ü Obejective-see → https://objective-see.com/index.html
ü Blackbag blog → https://www.blackbagtech.com/index.php/blog
ü SentinelOne → https://www.sentinelone.com/blog/
ü Focus Systems() → https://cyberforensic.focuss.com/knowledge/articles_detail/ü → https://github.com/slo-sleuth/slosleuth.github.io/blob/master/Apple/APFS%20Imaging.md

MAC(+, "#.*• Free toolü Mac-apt(https://github.com/ydkhatri/mac_apt)ü  .$(%'.!#.*

#.*-
ü Black Lightü RECON LABü AXIOM-  !?üMac),&